Generative Adversarial Network for Privacy-Preserving Data Synthesis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for preserving privacy in machine learning models, such as differential privacy and context-aware privacy, are either too conservative, reducing data utility or limited in data synthesis, and do not guarantee broad privacy protection, especially in untrusted environments where models are exposed as API endpoints.
Innovation Solution
The use of Generative Adversarial Networks (GANs) with a generator, discriminator, and privacy adversary to create representative data that preserves membership privacy, allowing for privacy-hardening and enabling generator black-box access with privacy guarantees in untrusted environments, thereby enhancing security in scenarios like crowd-sourced ML model development.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If differential privacy via SGD is used to protect privacy, then privacy protection is improved, but data utility is reduced
Solution Approach 1:
The patent creates synthetic copies of training data through a generator network that produces artificial data samples. These synthetic data copies preserve the statistical properties and utility needed for model training while being decoupled from the original sensitive data, thereby maintaining data utility without compromising privacy protection.
Solution Approach 2:
The patent introduces a privacy adversary as an intermediary component that acts as a mediator between the training data and the model. This adversary continuously attempts to infer membership information, and its feedback is used to adjust the training process, ensuring privacy protection is maintained while preserving data utility through adversarial refinement.
2Reliability
If manual data tokenisation, masking, and anonymisation are used, then privacy protection is improved, but re-identification attacks can still succeed
Solution Approach 1:
The system creates synthetic data copies that replicate the statistical properties of original data without containing actual personal information. These synthetic copies are used for training and cannot be directly re-identified, yet they maintain the utility needed for machine learning tasks.
Solution Approach 2:
The privacy adversary is trained in advance to detect membership information before actual attacks occur. This preliminary adversarial training strengthens the system's defenses by identifying and correcting privacy vulnerabilities before they can be exploited by external attackers.
3Ease of operation
If context-aware privacy with utility and sensitivity labels is used, then ease of optimization is improved, but broad privacy guarantee is not achieved
Solution Approach 1:
The system automatically optimizes privacy parameters through the adversarial training process without requiring manual intervention. The privacy adversary and generator engage in self-adjusting iterations where the adversary's attempts to break privacy automatically guide the generator to improve privacy preservation, achieving both ease of operation and strong privacy guarantees.
4Reliability
If encoder-based privacy is used to obfuscate data, then privacy protection is improved, but data synthesis capability is limited
Solution Approach 1:
The system dynamically generates data through a trained generator network that can produce synthetic samples on-demand. Unlike static encoding methods, this dynamic generation process can create unlimited synthetic data volume by continuously sampling from the learned data distribution, maintaining both privacy protection and data synthesis capability.
Data Source
AI summary
Methods and systems for generating representative data. A generator is configured to create, using a learning model, one or more generated records based on a plurality of training records obtained from a sensitive database. A discriminator is trained to identify the generated records as being generated based on the training records and a privacy adversary is trained to identify a training sample as being more similar to a distribution of the generated records than a distribution of the reference records.